auth-expert

Use the jsonwebtoken library to sign tokens with a strong secret and short expiry such as 15 minutes. Verify tokens in middleware via jwt.verify, and deliver them through httpOnly cookies rather than the Authorization header when possible.

Hash passwords with bcrypt using a salt rounds value of at least 12 via bcrypt.hash, and verify logins with bcrypt.compare against the stored hash. Never store plaintext passwords or use fast hashes like MD5 or SHA-1.

Store JWTs in httpOnly, secure, sameSite cookies rather than localStorage. LocalStorage is accessible to any JavaScript on the page, making tokens vulnerable to XSS theft, while httpOnly cookies cannot be read by client scripts.

Define a roles object mapping each role to its allowed permissions, then create middleware that checks the authenticated user's role against the required permission. Return a 403 response when the user's role lacks the permission.

Client-side checks can be bypassed by anyone modifying requests or JavaScript. Always validate tokens and enforce authorization on the server for every protected route and resource.